Cybersecurity researchers at Wordfence disclosed a supply chain attack on August 11 that compromised seven WordPress plugins from BdThemes by poisoning a remote JSON data feed rather than modifying any source code files in the official WordPress repository.
The attack created rogue administrator accounts and deployed PHP web shells on affected sites, all without requiring a single plugin update or file change on disk.
The technique is what makes this attack particularly dangerous for WordPress administrators everywhere. Traditional supply chain compromises modify plugin code directly, meaning security scanners that check file integrity would catch the change.
BdThemes’ attacker bypassed that entire detection layer by compromising the vendor’s cloud storage credentials instead. Attackers gained write access to a DigitalOcean Spaces bucket where BdThemes hosted promotional banner data, then replaced legitimate JSON responses with crafted payloads containing malicious JavaScript that exploited a cross-site scripting vulnerability in the JSON parsing code.
The affected plugins include:
- Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons [bdthemes-element-pack-lite] – 100,000+ active installs
- Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator [live-copy-paste] – 6,000+ active installs
- Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery [pixel-gallery] – N/A
- Prime Slider Addons for Elementor – Widgets, Templates & Elementor Addons [bdthemes-prime-slider-lite] – N/A
- Smart Admin Assistant – Dashboard and Site Enhancements [smart-admin-assistant] – N/A
- Ultimate Post Kit Addons for Elementor [ultimate-post-kit] – N/A
- Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor [ultimate-store-kit] – 6,000+ active installs
WordPress’s plugins team closed all seven listings on August 7 and 8, making them unavailable for download pending a full review.
The attack chain operated with surgical precision through every stage of the compromise. The malicious JSON loaded on every wp-admin page. That means any logged-in administrator’s browser silently executed the injected script without any visible indication of compromise. From there, the script contacted a command-and-control server at ia-cdn[.]com to receive targeting instructions. If the C2 server gave the go-ahead, the payload created a rogue administrator account via WordPress’s REST API, downloaded a fake plugin ZIP from the C2 server, and installed a PHP web shell named “emer-run.php” through the standard plugin upload form.
The persistence mechanisms were equally sophisticated in how they concealed the attacker’s presence from site owners. The web shell installed two modules into WordPress’s Must-Use plugins directory. The first was a “magic-login backdoor” that allowed unauthenticated administrative entry via a URL parameter targeting the site’s longest-registered administrator. Second, an anti-analysis stealth module that hooked into WordPress database queries to hide the rogue accounts from the administrative user list entirely. The stealth module even adjusted the displayed user count. Possibly to exclude the fake accounts, meaning administrators checking their user lists would see nothing unusual.
A second payload variant used an even more clever approach by generating “deterministic” credentials mathematically derived from each victim website’s hostname. The algorithm produced predictable usernames (bd_ followed by a six-character hash) and passwords (Bd@26! followed by the hash), meaning attackers could compute valid login credentials for any compromised site without storing a centralized list of targets.
“The fact that malicious JSON records and the secondary x.js payload were uploaded directly into the vendor’s own bucket indicates a severe upstream compromise of BdThemes’ cloud storage credentials or internal infrastructure,” Wordfence said.
Wordfence connected the C2 infrastructure to two other recent WordPress supply chain attacks. Those attacks were targeting Advanced Responsive Video Embedder and OptinMonster, suggesting a coordinated campaign. It is possible that these were aimed at establishing covert administrative persistence and remote code execution across WordPress environments at scale.
The poisoned JSON records first appeared on March 1, 2026, in the Prime Slider plugin. It later started spreading to other pluginss, meaning the compromise potentially ran undetected for over five months before discovery.
